CVE-2026-60868: Oracle Advanced Pricing Auth Bypass Flaw

CVE-2026-60868 Overview

CVE-2026-60868 is a high-severity vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite, specifically within the Pricing Installation component. The flaw affects supported versions 12.2.14 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this vulnerability, though exploitation is rated as difficult due to high attack complexity. Successful exploitation allows unauthorized access to critical data and unauthorized modification of a subset of Oracle Advanced Pricing data. The vulnerability includes a scope change, meaning attacks may impact additional Oracle products beyond Advanced Pricing itself.

Critical Impact
Authenticated attackers can gain complete read access to Oracle Advanced Pricing data and modify a subset of that data, with impacts extending to additional Oracle products through scope change.

Affected Products

Oracle E-Business Suite Advanced Pricing version 12.2.14
Oracle E-Business Suite Advanced Pricing version 12.2.15
Pricing Installation component within Oracle E-Business Suite

Discovery Timeline

2026-07-21 - CVE-2026-60868 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60868

Vulnerability Analysis

The vulnerability resides in the Pricing Installation component of Oracle Advanced Pricing, part of the broader Oracle E-Business Suite. Attackers require valid low-privileged credentials and network access via HTTP to reach the vulnerable component. The scope change indicator means that a successful exploit crosses a security boundary, affecting resources managed by components other than the vulnerable one. This behavior typically arises when the compromised component executes actions or reads data on behalf of adjacent services in the E-Business Suite stack. The EPSS probability of 0.242% indicates a low current likelihood of exploitation attempts observed in the wild.

Root Cause

Oracle has not published detailed root cause information in accordance with its standard Critical Patch Update disclosure policy. Based on the component name and CVSS metrics, the flaw is reachable through HTTP-facing interfaces of the Pricing Installation module and permits authenticated users to bypass intended data access restrictions. The high attack complexity suggests specific preconditions, such as particular installation states or configuration values, must be met for exploitation to succeed.

Attack Vector

Exploitation requires network access via HTTP to the Oracle E-Business Suite instance and a low-privileged authenticated account. No user interaction is required. The attacker submits crafted HTTP requests to the Pricing Installation component to trigger unauthorized data access or modification. Because the vulnerability produces a scope change, the impact can extend to data owned by other Oracle E-Business Suite modules that share trust relationships with Advanced Pricing.

No public proof-of-concept or exploit code has been released. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60868

Indicators of Compromise

Unexpected HTTP requests from low-privileged user sessions targeting Oracle Advanced Pricing Installation endpoints.
Anomalous read or modification activity against Advanced Pricing tables outside of standard business workflows.
Access patterns where a single authenticated user session touches pricing data volumes inconsistent with the account's role.

Detection Strategies

Enable Oracle E-Business Suite auditing on Advanced Pricing schemas and correlate database audit events with application-tier user sessions.
Deploy web application firewall rules that inspect HTTP requests to Pricing Installation URIs and flag requests with unusual parameter structures.
Baseline normal API and page access patterns per user role and alert on deviations that indicate privilege abuse.

Monitoring Recommendations

Monitor Oracle E-Business Suite application server logs for 4xx/5xx spikes and repeated access to the Pricing Installation component.
Track authenticated user session behavior across module boundaries to detect scope-crossing activity indicative of the vulnerability's impact.
Forward Oracle EBS audit logs to a centralized log platform for retention and correlation with identity and network telemetry.

How to Mitigate CVE-2026-60868

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite Advanced Pricing on all affected 12.2.14 and 12.2.15 instances.
Review accounts with access to Oracle Advanced Pricing and remove unnecessary low-privilege access from users who do not require it.
Restrict network exposure of Oracle E-Business Suite HTTP endpoints to trusted internal networks and authenticated VPN users only.

Patch Information

Oracle addressed CVE-2026-60868 in the July 2026 Critical Patch Update. Administrators should download and install the applicable patches referenced in the Oracle Security Alert July 2026. Oracle recommends applying Critical Patch Update fixes without delay because supported product versions no longer receive security fixes through other channels.

Workarounds

No official workaround has been published by Oracle. Patching remains the only supported remediation path.
Enforce network-layer access controls that limit HTTP reachability of the Pricing Installation component to administrative networks until patches are deployed.
Increase logging verbosity on Advanced Pricing modules and review activity daily until the patch is applied across the environment.

bash

# Verify installed Oracle E-Business Suite Advanced Pricing version
# Run from the EBS application tier as the applmgr user
sqlplus apps/<password> <<EOF
SELECT patch_level FROM fnd_product_installations
WHERE application_id = (SELECT application_id FROM fnd_application
                       WHERE application_short_name = 'QP');
EOF